CSRB incident reporting: the proposed 24/72-hour model for MSPs

The Cyber Security and Resilience (Network and Information Systems) Bill proposes a two-stage incident-reporting process for regulated entities, including relevant managed service providers (RMSPs). The proposed model is an initial notification within 24 hours of becoming aware that an incident is taking place, followed by a fuller report within 72 hours. These are proposed timeframes, not new CSRB duties in force today.

As at 21 October 2026, the Bill remains before Parliament. The latest published text is HL Bill 49, as amended in Grand Committee. (Updated 30 October 2026) Lords Report Stage took place on 26 October 2026 and the Bill was reprinted as HL Bill 62. Lords Third Reading is provisionally expected on 2 November 2026. The proposed RMSP and incident-reporting measures are expected to be brought into force through secondary legislation following Royal Assent. Royal Assent and commencement are separate steps.

What does the proposed model say?

The Government’s incident-reporting factsheet describes a light-touch initial notification to the regulator, with the NCSC informed at the same time, followed by a fuller report. The proposed 24-hour period starts when the regulated entity becomes aware that an incident is taking place. The 72-hour report contains more detail, insofar as it is known.

For RMSPs and relevant digital service providers, the factsheet also describes a proposed requirement to inform customers likely to have been adversely affected. The Bill and later rules will determine the applicable duties and operation. This is not a present CSRB obligation.

What remains unresolved?

The Government says supplementary incident-reporting thresholds will be set through secondary legislation after consultation, with regulator guidance. Those thresholds will help determine which incidents are significant and reportable. The proposed RMSP regime is also subject to commencement and further implementation detail. Do not infer that every cyber incident triggers the proposed model or treat a Secordit checklist as an official legal test.

What can MSPs prepare now?

Preparation can be useful without presenting proposed duties as current law. At a general business level, consider documenting who coordinates incident decisions, where incident timestamps and evidence are recorded, how customer impact is assessed, and how internal escalation and customer communications are handled. Keep these preparations aligned with the laws and contractual duties that currently apply to your organisation. The NCSC's incident management guidance covers planning your incident response processes. Review the Bill and official materials again after parliamentary changes or new regulations.

For smaller clients asking where to begin, our Small Business Cyber Starter Checklist is a printable starting point.

The proposed 24/72-hour framework may change before it is implemented. For practical first steps after a suspected breach, see the First Hour After a Breach kit.

Sources: UK Parliament Bill stages; current Bill text; GOV.UK incident-reporting factsheet; GOV.UK RMSP factsheet.

Secordit Intelligence products are operational intelligence and compliance readiness materials. They do not constitute legal advice and do not guarantee regulatory outcomes. Buyers should verify current legal requirements against official sources and seek legal advice where required.

Last reviewed: 21 October 2026
Matthew Protheroe-Hill, Founder, Secordit Intelligence